Secure Boot Certificate Status

If Windows Security says Secure Boot is using an older boot trust configuration, it usually means the PC has not completed Microsoft’s 2026 Secure Boot certificate transition yet. It is not a malware alert by itself. Install current Windows updates, restart when prompted, check OEM firmware updates on older devices, and follow the badge color in Windows Security before dismissing the warning.

Microsoft’s February 10, 2026 Windows 11 security updates were part of a longer Secure Boot maintenance cycle. The important user-facing change arrived later: starting in April 2026, Windows Security began showing Secure Boot certificate update status under Device security > Secure Boot. That makes this article less about one Patch Tuesday and more about understanding the status messages Windows now shows.

For related boot-protection context, see our coverage of the YellowKey BitLocker bypass report, which shows why Secure Boot maintenance and BitLocker protector choices should be audited together on high-value Windows devices.

What Windows Security is checking

Secure Boot uses trusted certificate material to decide which early boot components are allowed to load. Microsoft says some Windows devices still depend on certificates issued in 2011, while the ecosystem is moving to newer 2023 certificates before older trust material expires in 2026 [1]. A device that has not completed the transition can still boot, but it may miss future boot-level protections for Windows Boot Manager, revocation updates, or other pre-OS components [2].

That is why the warning can look serious even when the PC appears normal. It is a trust-chain maintenance signal, not proof that a bootkit or ordinary malware is already present. If Secure Boot was turned off unexpectedly, firmware settings changed after a suspicious download, or security tools report boot-level detections, treat that as a separate incident and review our bootkit protection guide.

What each Secure Boot status means

• Green / fully updated: Windows Security says Secure Boot is on and all required certificate updates have been applied. No certificate action is needed.
• Older boot trust configuration: Secure Boot is on, but the device still uses older trust material. Install Windows updates, stay connected to the internet, and restart if Windows asks.
• Paused because of a known issue: Microsoft has temporarily paused certificate updates for that device configuration. Do not force firmware resets; wait for the supported fix unless your OEM or IT team gives device-specific instructions.
• Not enough data to classify: Windows needs more validation before the automatic update can proceed. Keep Windows updated and use Microsoft’s Secure Boot guidance link from the Windows Security message.
• Hardware or firmware limitation: the automated update may be blocked by the device firmware. Check the PC vendor’s BIOS/UEFI update page or contact the manufacturer.
• Red / requires action: Windows says a boot-security update cannot be serviced on the current boot configuration. Do not dismiss this casually; follow Windows Security guidance, update firmware where available, and involve IT support for managed devices.

What to do on a home PC

1. Open Windows Security > Device security > Secure Boot and read the full message, not only the badge color.
2. Install the latest Windows cumulative update for your supported Windows version.
3. Restart when prompted. Some Secure Boot certificate changes are not complete until after reboot.
4. Check your PC maker’s support page for BIOS/UEFI firmware updates, especially on older laptops and desktops.
5. If Windows Security says the update is paused because of a known issue, do not reset Secure Boot keys or firmware defaults unless Microsoft or the OEM specifically tells you to.
6. If you see repeated BitLocker recovery prompts, startup hangs, or boot validation errors, save your BitLocker recovery key and use Microsoft/OEM troubleshooting before changing firmware settings.

For most consumer PCs, the expected outcome is automatic: Windows Update delivers the certificate update, Windows Security changes to the fully updated state, and no malware cleanup is required. A scan is useful only when the Secure Boot warning appears together with suspicious downloads, unknown drivers, fake update prompts, or recurring security-tool alerts.

What admins should audit

• Inventory which Windows 10, Windows 11, and Windows Server builds are still in scope for Secure Boot certificate servicing.
• Check Secure Boot state, firmware version, BitLocker recovery behavior, and update compliance before broad deployment.
• Track Microsoft’s Secure Boot update events and registry/status signals rather than relying only on a green Windows Security icon.
• Pilot firmware and certificate updates on representative hardware before pushing broad policy changes.
• For enterprise-managed devices, use Microsoft’s IT guidance instead of telling users to dismiss the badge locally [3].

Related reading: our breakdown of a recent Windows CVE, the write-up on a critical Windows TCP/IP flaw, and a practical Windows security checklist for everyday hardening.

FAQ

References

1. Microsoft Support. “Secure Boot certificate update status in the Windows Security app.” Microsoft, KB5087130, published April 2, 2026, accessed June 1, 2026. Microsoft Support
2. Microsoft Learn. “Update Secure Boot Certificates for Windows Devices.” Microsoft, last updated May 1, 2026, accessed June 1, 2026. Microsoft Learn
3. Microsoft Support. “Secure Boot troubleshooting guide.” Microsoft, KB5085046, published March 19, 2026, accessed June 1, 2026. Microsoft Support